Lessons from Dubai

The 3 August Emirates Boeing 777 crash at Dubai may have happened a while ago, but the man/machine interface implications are so complex it still has human factors experts’ heads spinning.

Following an uneventful final approach to runway 12L the aircraft hit the runway with its gear in the retraction cycle, slid to a halt on its belly and burst into flames. All on board got out alive before the fire destroyed the fuselage, but a firefighter was killed by a fuel tank explosion.

That’s a surprising outcome for a serviceable aeroplane carrying out a normal landing at its home base.

So what happened?

Flight EK521 was inbound from Thiruvananthapuram, India carrying 282 passengers and 18 crew. The ambient temperature was high, nearly 50degC, and there was a windshear warning on all runways, but this did not cite high winds or powerful gusts. Probably the wind was swinging around under the influence of vertical air currents generated by intense surface heating combined with the coastal effect.

When the 777 had about 5nm to go on approach to 12L ATC cleared it to land and told the crew the surface wind was 340deg/11kt. That’s a touchdown-zone tailwind.

As the aircraft descended through 1,100ft on final approach the aircraft was also registering an airborne tailwind. It persisted almost all the way down.

But apart from the tailwind on the aircraft’s approach, the descent was uneventful until just before touchdown. At that point the tailwind switched to a headwind, adding about 20kt to the 777’s airspeed.

Around 5sec after the flare the right gear touched down about 1,100m beyond the threshold, and 3sec after that both main gear touchdown switches were made and the RAAS (runway awareness advisory system) voiced the alert “long landing, long landing”.

Questions still remain about exactly what happened next on the flightdeck. Who did what, and why?

The United Arab Emirates General Civil Aviation Authority has released some factual information about weather and aircraft performance, but the investigators are expected to take another three months or so to ready their final report.

Meanwhile from what the GCAA has released, we know that the captain was the pilot flying. He disconnected the autopilot at about 900ft on approach but left the autothrottle in. When he began the flare at 35ft AGL the throttles retarded to idle, and within about 10sec both touchdown switches had been made.

What happened next, or at least why it happened, is difficult to work out.

Witnesses say the aircraft “bounced” from the first touchdown. But the crew was attempting a go-around – possibly prompted by the “long landing” alert mentioned earlier – so the “bounce” may have been the result of the crew pulling the nose up for a go-around.

Some 4sec after the warning the aircraft was airborne again, the crew reduced the flap setting to 20deg, and 2sec later selected the gear up, both acts part of a go-around drill.

But the throttle levers remained at idle.

About 5sec after the aircraft had become airborne the tower, noticing the apparent intention,  cleared the aircraft straight ahead to 4,000ft, and the crew read that back. Then the first officer called “check speed”, the throttle levers were moved from idle to fully forward, and the autothrust transitioned from idle mode to thrust mode.

Unfortunately the increasing engine power arrived too late to prevent the aircraft sinking back onto the runway with its gear almost fully up. It slid on its belly for 800m before coming to rest with the right engine detached and a fire under that wing.

The GCAA interim report doesn’t mention whether or not the crew attempted to trigger go-around power by selecting the TO/GA (take-off/go-around) switches at the time of the go-around decision, but it appends a page from the flight crew operating manual about autothrust modes.  It contains this sentence: “The TO/GA switches are inhibited when on the ground and enabled again when in the air for a go around or touch and go.”

This situation raises questions galore. In a go-around situation the drill is to select power first, then set the appropriate flap, then register a positive rate of climb and pull the gear up. Maybe the crew thought activating TO/GA was enough, but they didn’t monitor engine power, throttle lever movement or rate of climb before retracting the gear.

This is basic stuff, so what’s going on here?

Are we witnessing the actions of a crew rendered insensitive by automation, or de-skilled by the same thing? Or is this an event involving mode-confusion because of the complexity of modern aircraft and their smart control systems?

The industry is going through a crisis of confidence in pilot training. The doubt arises from increasing numbers of accidents that began with a non-critical fault or distraction and result in the pilots becoming startled and not acting as they had been trained to do.

Behind it all is the fact that today’s aircraft and their systems are impressive and reliable, but ultra-complex. Meanwhile the basic approach to pilot training is the much the same at was in the pre-digital era.

Emirates is in the vanguard of modern attitudes toward evidence-based training, but maybe the fundamentals are set before pilots reach the line.

Finally, pilots are never really trained to operate the digital systems they use all the time at work. They just learn that on the job.

Let’s go back a bit to the quote from the Emirates 777 FCOM: “The TO/GA switches are inhibited when on the ground and enabled again when in the air for a go around or touch and go.”

I bet the pilots never tried that in the simulator.

Modern aeroplanes now are rather like personal computers in the relationship pilots have with them: most people are skillful users of tablets or laptops for routine tasks, but never have a chance to try out their full capabilities, most of which would rarely be needed. But if things go wrong or something unusual happens, the user is often out of his depth.

The Royal Aeronautical Society is hosting its two-day International Flight Crew Training Conference in London next week. This is one of the subjects that will be examined there.

Flydubai accident update from MAK

Russian accident investigator MAK has released preliminary information from the flight data recorder suggesting that there was no mechanical or aircraft systems fault in the Flydubai Boeing 737-800 at the time it appeared to go out of control and crash on final approach to Rostov on Don (see details in blog entry for 20 March).

Also since the previous blog story was written, video imagery has been released indicating that the final trajectory of the aircraft to impact was a nose-down high speed dive, which matches closely the flight profile of a Tatarstan Airlines 737-500 before it crashed on approach to Kazan, Russia in November 2013 (see also 20 March story for details).

If the MAK confirms these details in a fuller release soon it will highlight a need for the industry to train crews better for all-engines go-around manoeuvres because of the potentially dangerous combination – especially at night or in IMC – of the strong pitch-up moment caused by go-around power from underslung engines, plus “somatogravic illusion” in the pilots. Somatogravic illusion is the feeling induced by rapid forward acceleration that the nose has pitched up when it has not.

Another factor in this lack of crew familiarity with all-engines-go-around risks is believed to be that the go-arounds most practiced during recurrent training involve an engine-out abandoned approach, in which the power, pitch-up moment, climb rate and airspeed acceleration are all much more gentle.

The Flight Safety Foundation has been alerting airlines to this risk for many years now, and some airlines have modified their recurrent training accordingly.

Pilot groups in Dubai are also alleging that crew fatigue may have played a part in this accident. If this is true, it will emerge in the MAK final report.